- Freeradius-Users - lists.freeradius.org

Re: I-D for a new method: EAP-Kerberos
by Rick van Rein 05 Apr '16

05 Apr '16

Hi, @Alan Yes, I meant Kerberos over EAP. Arran> I think EAP-Kerberos would be useful to bootstrap kerberos SSO during network login. Arran> I've been waiting for someone to come up with standard for this for 10 years You may want to have a look at the following references, sent to me by Rafael Marín López of Uni Madrid in Spain: 1. - Rafael Marín López, Fernando Pereñiguez-Garcia, Yoshihiro Ohba, Fernando Bernal-Hidalgo, Antonio F. Gómez-Skarmeta: A Kerberized Architecture for Fast Re-authentication in Heterogeneous Wireless Networks 2. - EAP-Kerberos: Leveraging the Kerberos Credential Caching Mechanism for Faster Re-authentications in Wireless Access Networks Saber Zrelli, Nobuo Okabe, Yoichi Shinoda https://tools.ietf.org/html/draft-marin-eap-frm-fastreauth-03 https://tools.ietf.org/html/draft-zrelli-eap-frap-04 I still need to read up on these to see if what I'm proposing is really new. But it is really helpful to have seen your acknowledgement that I'm on to something useful. Thanks! -Rick

1 0

Freeradius 3.0.4 Accounting [sql-relay problem]
by Ibrahim Almahfooz 04 Apr '16

04 Apr '16

Hi Everyone, We are currently running FreeRADIUS 3.0.4 as an accounting server installed from the repository on CentOS 7 server. We have almost 25k adsl,vdsl,gpon users in the network. The BRAS [NAS] is sending the accounting data to the FreeRADIUS. Instead of writing accounting data directly to the MySQL db, we configured it to write the sql statements to the sql-relay file and set a crontab to dump it to the remote db every 15 minutes using *radsqlrelay* command: radsqlrelay -x -h x.x.x.x -d mysql -b mysqldb -u root -pdbpassword -1 /var/log/radius/radacct/sql-relay While the above command run by the crontab, we see sql-relay.work file writing the background and we assume this is normal in order to write the incoming accounting data while doing the sql-relay transfer to the remote db. After a couple of days of setting everything, our [BRAS] NAS device has reported accounting errors in its statistics like accounting start not successfully sent or accounting stop not successfully sent and statistics shows the errors are happening randomly every one, two or six hours. We start doing investigations and found that in the radius.log there are many errors happening in the same time the radsqlrelay running by the crontab, the error is below: Fri Apr 1 03:59:23 2016 : Info: rlm_sql (sql): 0 of 3 connections in use. Need more spares Fri Apr 1 03:59:23 2016 : Info: rlm_sql (sql): Opening additional connection (73115) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 4 of 4 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73116) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 5 of 5 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73117) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 6 of 6 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73118) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 7 of 7 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73119) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 7 of 7 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73120) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 9 of 9 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73121) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 10 of 10 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73122) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 11 of 11 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73123) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 12 of 12 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73124) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 13 of 13 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73125) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 14 of 14 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73126) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 15 of 15 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73127) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 16 of 16 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73128) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 17 of 17 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73129) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 18 of 18 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73130) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 19 of 19 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73131) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 20 of 20 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73132) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 21 of 21 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73133) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 22 of 22 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73134) Fri Apr 1 04:00:02 2016 : Warning: rlm_sql (sql): 23 of 23 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:02 2016 : Info: rlm_sql (sql): Opening additional connection (73135) Fri Apr 1 04:00:03 2016 : Warning: rlm_sql (sql): 24 of 24 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:03 2016 : Warning: rlm_sql (sql): 24 of 24 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:03 2016 : Info: rlm_sql (sql): Opening additional connection (73136) Fri Apr 1 04:00:03 2016 : Info: rlm_sql (sql): Opening additional connection (73137) Fri Apr 1 04:00:03 2016 : Warning: rlm_sql (sql): 26 of 26 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:03 2016 : Info: rlm_sql (sql): Opening additional connection (73138) Fri Apr 1 04:00:03 2016 : Warning: rlm_sql (sql): 27 of 27 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:03 2016 : Info: rlm_sql (sql): Opening additional connection (73139) Fri Apr 1 04:00:03 2016 : Warning: rlm_sql (sql): 28 of 28 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:03 2016 : Info: rlm_sql (sql): Opening additional connection (73140) Fri Apr 1 04:00:03 2016 : Warning: rlm_sql (sql): 29 of 29 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:03 2016 : Info: rlm_sql (sql): Opening additional connection (73141) Fri Apr 1 04:00:03 2016 : Warning: rlm_sql (sql): 30 of 30 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:03 2016 : Info: rlm_sql (sql): Opening additional connection (73142) Fri Apr 1 04:00:03 2016 : Warning: rlm_sql (sql): 31 of 31 connections in use. You probably need to increase "spare" Fri Apr 1 04:00:03 2016 : Info: rlm_sql (sql): Opening additional connection (73143) Fri Apr 1 04:00:09 2016 : Error: 1 requests have been waiting in the processing queue for 6 seconds. Check that all databases are running properly! >From the radius.log we see this error start happening exactly while the crontab of dumping the sql-relay happens but not on every crontab job! We are not running any db in the same FreeRADIUS since we are writing to the file. Obviously, the FR server is considering sql-relay as database and report the error "Check that all databases are running properly!" Seems like the radius stops responding (not always) when dumping the sql-relay file to the mysql db. Also we sometimes see error of more than 50 requests have been waiting in the processing… in the radius.log. And that actually what triggers the NAS device to consider the freeRadius as down status. Surprisingly, our NAS start again sending accounting packet and the server goes normally. and this error keep showing on both radius.log and the NAS from now and then. And this probably means "Loss of accounting data" Actually we have no idea why this behaviour is occurring. We start thinking if there is any size or performance limitation in the sql-relay.work file? Or may be a bug in this version and we are unaware of the fix if exists? Any ideas? Best, Ibrahim System Administrator

2 1

FreeRADIUS 3 certificate issue on some Windows clients
by Tomáš Ivánek 04 Apr '16

04 Apr '16

I'm running FreeRADIUS 3.0.11 with OpenSSL 1.0.2g. I have successfully configured EAP TLS, TTLS and PEAP methods. Now the issue...when I'm configuring clients with Windows 7, Vista or XP and certificates are not yet installed (ca.der and optionally client.p12) and try to connect to the network through the bottom right network icon a bubble popup shows up telling me that I need to installl the certificates. The connection can't be established, which is how it should behave. When i configure the connection manually, import the certs, all the methods mentioned above works well. The manual configuration also work well on Windows 10 and can't connect until at least the ca.der is present on the computer for PEAP and TTLS. However when any of theese certificates are not present on the Windows 10 machine and try to connect through the network menu in the bottom right corner the connection is successfully created after entering login credentials. It seems like it's bypassing the ca.der certificate somehow. I have the same problem with windows phone 7.X devices. Is there a way how to prevent this behaviour? The server shouldn't allow the connection, am I right? here is the output od radiusd -X with example login through windows phone 7 device. It's a .txt file on my google drive. Thank you https://drive.google.com/file/d/0B9T3_pXPBXRnZklXRjJDcmVHek0/view?usp= sharing (https://drive.google.com/file/d/0B9T3_pXPBXRnZklXRjJDcmVHek0/view?usp=shari…)

3 2

two freeradius servers - question for advice
by Marcin 04 Apr '16

04 Apr '16

Hi everyone, I'm going to start two freeradius servers to authenticate PPPoE users, both independent of the other. First as primary and second as secondary. I'm going to start PostgreSQL server also, but in case of unavailability of sql server freeradius server must have work properly. Both freeradius have to have actual data of arleady logged users to provide simultanieusly use. I'm going to check authenticate in db and if if failed get user from files (created in background). accounitng i'm going to do with linelog and afterwards put in to database. I need advice from you, more advanced users than me. How to achieve that HA and avablitity. Thanks in advance. -- Best Regards Marcin / nicraM

3 7

disconnect Error-Cause = Unsupported-Extension‏
by Syed Jahanzaib 04 Apr '16

04 Apr '16

I am using FR 2.1.10 with Mikrotik 6.34.4 COA is working fine and Bandwidth change on the fly working ok. I can disconnect client using radclient as well from cli but disconnect user via update disconnect in FR gives following error: Sending Disconnect-Request of id 7 to 101.11.11.255 port 3799 User-Name = "zaib" rad_recv: Disconnect-NAK packet from host 101.11.11.255 port 3799, id=7, length=42 Error-Cause = Unsupported-Extension NAS-Identifier = "MikroTik" Code: update disconnect { User-Name = "%{request:User-Name}" -- Regard's

2 1

rfc6929 - tlv attributes in extended attribute 246
by Vereecke, Katrien (Nokia - BE) 04 Apr '16

04 Apr '16

Hello, I see a difference in behavior for a tlv attribute in an extended attribute 246 in FreeRadius version 3.0.x and FreeRadius version 3.1.x. My dictionary contains the following attributes: BEGIN-VENDOR Alcatel-IPD format=Extended-Vendor-Specific-6 ATTRIBUTE Alcatel-IPD-Ext-6-TestAttr-1 1 integer ATTRIBUTE Alcatel-IPD-Ext-6-TestAttr-2 2 string ATTRIBUTE Alcatel-IPD-Ext-6-TestAttr-3 3 tlv ATTRIBUTE Alcatel-IPD-Ext-6-TestAttr-3-1 3.1 string ATTRIBUTE Alcatel-IPD-Ext-6-TestAttr-3-2 3.2 tlv ATTRIBUTE Alcatel-IPD-Ext-6-TestAttr-3-2-1 3.2.1 string END-VENDOR Alcatel-IPD I have the following attributes in my users file: Alcatel-IPD-Ext-6-TestAttr-2 = "test3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLenAttention", Alcatel-IPD-Ext-6-TestAttr-3-1 = "testattr_3_1", Alcatel-IPD-Ext-6-TestAttr-3-2-1 = "testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1", The output of the freeRadius server in version 3.0.x : The access-Accept message: (2) Sent Access-Accept Id 14 from 138.203.10.191:1812 to 138.203.10.123:64388 length 0 .... ..... (2) Alcatel-IPD-Ext-6-TestAttr-2 = "test3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLente" (2) Alcatel-IPD-Ext-6-TestAttr-3-1 = "testattr_3_1" (2) Alcatel-IPD-Ext-6-TestAttr-3-2-1 = "testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr" The output of the FreeRadius server in version 3.1.x: (0) Alcatel-IPD-Ext-6-TestAttr-2 = "test3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLentest3FragWithLongLente" (0) Alcatel-IPD-Ext-6-TestAttr-3-1 = "testattr_3_1" (0) Alcatel-IPD-Ext-6-TestAttr-3-2-1 = "testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr_3_2_1testAttr" Although the output of the FreeRadius server shows the same output in version 3.0.x and version 3.1.x , wiresharks shows that there is a difference in the access-accept packet sent, In version 3.0.x the packet contains all the information for the tlv attribute Alcatel-IPD-Ext-6-TestAttr-3_xx while in version 3.1.x I only see the attribute Alcatel-IPD-Ext-6-TestAttr-3-1. Wireshark for version 3.0.x: Frame 623: 1223 bytes on wire (9784 bits), 1223 bytes captured (9784 bits) on interface 0 Ethernet II, Src: SuperMic_a2:12:54 (00:25:90:a2:12:54), Dst: SuperMic_57:a0:76 (00:25:90:57:a0:76) Internet Protocol Version 4, Src: 138.203.10.191, Dst: 138.203.10.123 User Datagram Protocol, Src Port: 1812 (1812), Dst Port: 64388 (64388) RADIUS Protocol Code: Access-Accept (2) Packet identifier: 0xe (14) Length: 2661 Authenticator: a01937c98d28165fc4c238e5cd8867cd [This is a response to a request in frame 615] [Time from request: 0.000860000 seconds] Attribute Value Pairs AVP: l=7 t=Unknown-Attribute(241): 060000003c .... AVP: l=255 t=Unknown-Attribute(246): 1a800000197f02746573743346726167576974684c6f6e67... AVP: l=147 t=Unknown-Attribute(246): 1a00726167576974684c6f6e674c656e7465737433467261... AVP: l=255 t=Unknown-Attribute(246): 1a800000197f03010e74657374617474725f335f3102ff01... AVP: l=27 t=Unknown-Attribute(246): 1a00417474725f335f325f3174657374417474725f335f32... AVP: l=7 t=Unknown-Attribute(243): 0b00000005 AVP: l=7 t=Unknown-Attribute(243): 0b00000006 .... AVP: l=11 t=Reply-Message(18): Welcome!\n Wireshark for version 3.1.x: Frame 516: 638 bytes on wire (5104 bits), 638 bytes captured (5104 bits) on interface 0 Ethernet II, Src: SuperMic_a2:12:54 (00:25:90:a2:12:54), Dst: SuperMic_57:a0:76 (00:25:90:57:a0:76) Internet Protocol Version 4, Src: 138.203.10.191, Dst: 138.203.10.123 User Datagram Protocol, Src Port: 1812 (1812), Dst Port: 64384 (64384) RADIUS Protocol Code: Access-Accept (2) Packet identifier: 0xf (15) Length: 2076 Authenticator: 4545fca0176c445525748ced32857ae1 [This is a response to a request in frame 502] [Time from request: 0.003358000 seconds] Attribute Value Pairs AVP: l=7 t=Unknown-Attribute(241): 060000003c .... AVP: l=255 t=Unknown-Attribute(246): 1a800000197f02746573743346726167576974684c6f6e67... AVP: l=147 t=Unknown-Attribute(246): 1a00726167576974684c6f6e674c656e7465737433467261... AVP: l=23 t=Unknown-Attribute(246): 1a000000197f03010e74657374617474725f335f31 AVP: l=7 t=Unknown-Attribute(243): 0b00000005 AVP: l=7 t=Unknown-Attribute(243): 0b00000006 .... AVP: l=11 t=Reply-Message(18): Welcome!\n I think the behavior of the FreeRadius version v3.0.x is ok. The access-accept contains the attribute Alcatel-IPD-Ext-6-TestAttr-3-1 and the attribute Alcatel-IPD-Ext-6-TestAttr-3-2-1 is partially in the first fragment and in the second fragment for the max length of 255 bytes. This is not the case in FreeRadius version v3.1.x? Thanks, Kind regards, Katrien.

2 1

Freeradius 2.2.9 not works
by Mr Dini 04 Apr '16

04 Apr '16

Hi! I compiled the freeradius 2.2.9 on my nas and I configured a MySQL database for radius. It seems like works, but if I make a test connection from my router, it sends an Access-Reject package... If I make a radtest it also sends Access-Reject package, but if I edit the Cleartext-Password := guest1234 to Password == guest1234 it sends Access-Accept package... Why? What's wrong? Thanks for your answer!

2 3

New Install
by Cameron Murray 04 Apr '16

04 Apr '16

Guys, First time member and have a slight issue. Fresh Centos 6.7 64bit install and Freeradius installed with a remote MySQL server. Service launches perfectly in debug and daemon however it does not appear to be listening correctly. Netstat -a shows Radius and Radius Account open on * however when I query radius with radtest or radping it sees no data. udp 0 0 *:radius *:* udp 0 0 *:radius-acct *:* Iptables has been disabled and confirmed after reboot. I've tested radping from localhost and the Mysql Server with the same result: radtest test test 192.168.0.250 1812 123456789 Sending Access-Request of id 15 to 192.168.0.250 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 192.168.10.251 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Request of id 15 to 192.168.0.250 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 192.168.10.251 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Request of id 15 to 192.168.0.250 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 192.168.10.251 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 radclient: no response from server for ID 15 socket 3 Is there a secret to make it listen correctly? TIA. Cameron

2 1

chap info freeradius 2.1.12
by khouzam yaghi 04 Apr '16

04 Apr '16

what does the info in the radius log means rarely i am getting this info in the radius log Auth: [chap] rlm_chap: Attribute "User-Name" is required for authentication.

2 1

No EAP response
by TOURE Amidou Florian 04 Apr '16

04 Apr '16

Hi all,I'm configuring a Network Access Control Solution (Packetfence ) but i have a problem to authenticate my users.I hope that someone will be able to help me.-I have a windows 2008 Active Directory for my users -I'm using a cisco 2950 switch to authenticate my users but when connecting a host i get this error on my switch,It seems like the switch cannot reach the server but i'm sure that the radius server ip address is 192.168.10.1 : RADIUS: Retransmit id 4 00:28:11: RADIUS: Retransmit id 4 00:28:13: RADIUS: Retransmit id 4 00:28:15: RADIUS: Marking server 192.168.10.1:1812,1813 dead 00:28:15: RADIUS: Tried all servers. 00:28:15: RADIUS: No valid server found. Trying any viable server 00:28:15: RADIUS: Tried all servers. 00:28:15: RADIUS: No response for id 4 00:28:15: AAA/AUTHEN (3539210218): status = ERROR 00:28:15: AAA/AUTHEN/START (3539210218): no methods left to try 00:28:15: AAA/AUTHEN (3539210218): status = ERROR 00:28:15: AAA/AUTHEN/START (3539210218): failed to authenticate 00:28:15: AAA/MEMORY: free_user_quiet (0x80D4E810) user='Prof-PC\Prof' ruser='Prof-PC\Prof' port='FastEthernet0/2' rem_addr='00-40-D0-67-D0-B1/00-18-BA-9B-E7-82' authen_type=6 service=17 priv=1 This is my swicth configuration here : Building configuration... Current configuration : 2480 bytes!version 12.1no service pad service timestamps debug uptime service timestamps log uptime no service password-encryption!hostname Switch!aaa new-modelaaa group server radius packetfence server 192.168.10.1 auth-port 1812 acct-port 1813!aaa authentication login default local aaa authentication dot1x default group packetfence aaa authorization network default group packetfence!username admin password 0 thegame ip subnet-zero!!spanning-tree mode pvst no spanning-tree optimize bpdu transmission spanning-tree extend system-id dot1x system-auth-control!!!!interface FastEthernet0/1 switchport trunk native vlan 10 switchport trunk allowed vlan 1,10,20,30,40,60,100 switchport mode trunk !interface FastEthernet0/2 switchport access vlan 4 switchport mode access dot1x port-control auto dot1x host-mode multi-host dot1x reauthentication spanning-tree portfast!interface FastEthernet0/3!interface FastEthernet0/4!interface FastEthernet0/5!interface FastEthernet0/6!interface FastEthernet0/7!interface FastEthernet0/8!interface FastEthernet0/9!interface FastEthernet0/10!interface FastEthernet0/11!interface FastEthernet0/12!interface FastEthernet0/13!interface FastEthernet0/14!interface FastEthernet0/15!interface FastEthernet0/16!interface FastEthernet0/17!interface FastEthernet0/18!interface FastEthernet0/19!interface FastEthernet0/20!interface FastEthernet0/21!interface FastEthernet0/22!interface FastEthernet0/23!interface FastEthernet0/24!interface Vlan1 no ip address no ip route-cache shutdown!interface Vlan4 ip address 192.168.4.1 255.255.255.0 no ip route-cache shutdown!interface Vlan10 ip address 192.168.1.5 255.255.255.0 ip helper-address 192.168.10.1 no ip route-cache!interface Vlan20 ip address 192.168.20.1 255.255.255.0 no ip route-cache shutdown!interface Vlan30 ip address 192.168.30.1 255.255.255.0 no ip route-cache shutdown!interface Vlan40 ip address 192.168.40.1 255.255.255.0 no ip route-cache shutdown!interface Vlan50 no ip address no ip route-cache shutdown!interface Vlan60 ip address 192.168.60.1 255.255.255.0 no ip route-cache shutdown!interface Vlan100 ip address 192.168.100.1 255.255.255.0 no ip route-cache shutdown! ip http server radius-server host 192.168.10.1 auth-port 1812 acct-port 1813 timeout 2 key thegame radius-server retransmit 3 radius-server vsa send authentication!line con 0line vty 5 15!!end

3 2